RxExpressOnline
RxExpressOnline is part of the Eva Pharmacy fraud. RxExpressOnline Read * Eva Pharmacy fraud description * FDA Press Announcement * CIPA listing of fraud sites * FDA Warning letter Description This operation is part of EvaPharmacy. It shares the same hosting IP addresses, name servers, registrars. It uses the same redirection technique, where many domains are registered with a subset of registrars, and they host redirectors to one or just a few central hosting sites. The redirector domains are treated as disposable, and appear in spam. The redirection targets do not appear in spam, to avoid being blacklisted. Website Claims Fake list of accreditations From a sample web site (click on the image to enlarge it) we can see a list of fake accreditations. * True accreditations provide a link to the web site of the accreditation authority. * Fake accreditations forge the information on the fake web site itself. The RxExpressOnline web site states: At RxExpressOnline, we maintain extremely rigorous standards in patient safety. We believe access to essential prescription drugs should be safe, convenient, and affordable for all. RxExpressOnline is a certified member of the '''Canadian International Pharmacy Association (CIPA)', the Manitoba International Pharmacists Association (MIPA), the Better Business Bureau (BBB) and HealthPricer.com and is a 5 star rated pharmacy from PharmacyChecker.com.'' However, all 5 of those references fail to link to any of the accreditation sites. They are a fake. Privacy and Security What is your security & privacy policy? A. We are committed to protecting your privacy with the highest possible level of security. All of your personal information, including credit card number, name, and address is encrypted, so that it cannot be read as it is being transmitted from your computer to our server. We use the Secure Socket Layer (SSL) protocol which enables end-to-end data protection. Here is a URL from November 2013 (which was registered in Russia on NAUNET): * http://m102.drugtorehealthcare.ru Another registered on NETLYNX in India is * http://private.prescriptionspills.com If you select a product (Viagra Soft Tabs), choose a quantity (60 pills) and "check out", you're presented with the following URL: * https://rxcheckoutnow.com/cart/checkout/ Notice that there is SSL formatting for this URL (https:// appears instead of http://.) The certificate for rxcheckoutnow.com was issued on Sept 1 2013 by RapidSSL CA from the GeoTrust Inc. organization. The details of the secure checkout server: Domain Name: RXCHECKOUTNOW.COM Registrar: CJSC REGISTRAR R01 Whois Server: whois.r01.ru Referral URL: http://r01.ru Name Server: NS202.RXCHECKOUTNOW.COM Name Server: NS940.RXCHECKOUTNOW.COM Status: clientRenewProhibited Status: clientTransferProhibited Updated Date: 26-sep-2013 Creation Date: 02-sep-2013 Expiration Date: 02-sep-2014 The details of a redirection target server: domain: HEALTHRXPHARMACYCARE.RU nserver: ns1.healthrxpharmacycare.ru. 217.68.34.147 nserver: ns2.healthrxpharmacycare.ru. 202.186.179.236 state: REGISTERED, DELEGATED, VERIFIED person: Private Person registrar: NAUNET-REG-RIPN admin-contact: https://client.naunet.ru/c/whoiscontact created: 2013.08.23 paid-till: 2014.08.23 From the location of the registrars, it is safe to assume that this is a Russian operation, consistent with the other EvaPharmacy family members. autocarepharmacy.com has been judged to be a rogue pharmacy at LegitScript. In November 2013, autocarepharmacy.com had address 193.107.89.251, located in Poland. Redirections Other redirection targets sharing the same host IP address at the same time found in November 2014 (now suspended) were From this table it is clear that RxExpressOnline is yet another of the illegal EvaPharmcy fraud operations. Their postal address They do not provide a postal address. This demonstrates that they do not want to be traced. Their Owners and Operators They provide no information on their web site. Another demonstration that they are avoiding being traced. Sponsor Organizations Registrars who accept payment for their domain names are * BIZCN.COM, INC. * HTTP.NET INTERNET GMBH (all suspended) * NAMESILO, LLC * NAUNET-REG-RIPN * NETLYNX, INC. (all suspended) * PSI-USA, INC. DBA DOMAIN ROBOT (all suspended) * TRUNKOZ TECHNOLOGIES PVT LTD. (all suspended) These are the top 7 registrars commonly selected by the EvaPharmacy operation Sample sites and registrars sponsoring them BIZCN.COM, INC. adelindvallie.com suspended almeriaalyda.xyz suspended brunhildathomasine.xyz suspended camelliapaulette.xyz suspended claudelleaurie.xyz suspended donettacharlena.xyz suspended dorrihyacinthia.xyz suspended dottycolette.xyz suspended gertienolana.xyz suspended lirabessy.xyz suspended lucretiacharmine.xyz suspended lynnansley.xyz suspended lynnyasmeen.com suspended patienceval.xyz suspended rebecadorie.xyz suspended taniagabi.xyz suspended adelindvallie.com almirerobinet.com doryalexis.com lynnyasmeen.com stephaelsinore.com Key-Systems GmbH adinabrietta.eu adriawilla.be ainsleeberet.be alexinejosselyn.be alexinewendi.be alfieliuka.be allitrisha.be annaleequintilla.be ansleyelyse.be ansleyelyse.be anyaimogene.be arabelreiko.eu arlueneamandie.be aurlieabbye.be averylwillamina.be bambiheath.be benitamichele.be biddyjobyna.be billicorny.be billicorny.be birdconstancy.be brandielinea.be breannecacilie.be brettperrine.eu brinnacathee.be britneyliva.be brittawynnie.be brittnebarbey.be camillacherice.be charlenaanthe.be charlenakristy.be charmionarda.eu chlorismildrid.be christianalannited.be cissydarelle.be claudettashelbi.be codierevkah.be codierevkah.be codikarolalma.be consueladaffie.be crisshanon.be danielevaleda.be danielevaleda.be dasyacodie.be dasyacodie.be dathadawnnadia.be dawnabeverlee.be deannemarilin.be deidrelibby.be devinneardra.be dianacelka.be donellelanette.be dorettajami.be dorryclare.eu edivajoceline.be elaineromonda.be elbertabarry.eu eleenkathlin.be emmieleeanne.be erinnnathalia.be faraleatracie.be farrahbabbobina.be fianntrudy.be fianntrudy.be florepolly.eu francescajolene.be genoverawinny.be genoverawinny.be georgetteandrei.eu gertilauree.be gilbertagoldina.be giorgiailysa.be giraldaamandi.be gladglennie.be godivapepita.be helenelizabethaudyshaun.eu horatiaarleta.be hortensialibbie.be jaimetanhya.be janellashayfawne.be janevacarolin.be jillyardyce.be joridebbieada.be karaleejamiglenn.be karilynnadan.be karrahcharlena.eu katharinetatum.be kileyardelle.be kimmietalyah.be latishacarmella.be lauriclara.eu lenkaconstance.be leslihortensia.be liannikolia.be liannikolia.be lissymerola.be lolitadalila.be luisefredrika.be luisefredrika.be lusadaffyfred.be lyndamagfeliza.eu magdalenafae.eu malissiaxenia.be mariskiperinn.be maritsanadeen.be martyleandra.be martyleandra.be mateldaaleda.be meaganamata.be meaganamata.be meggydeonne.eu michellpolly.be michellpolly.be mindyoneida.be miquelanichol.be naneteloralyn.eu nicolleruthann.eu odeliafidelia.be opalinegoldie.be opalinegoldie.be pierrettejinny.eu raneeklara.be ravenmarylynne.be rivacloepavia.eu roselleapril.be sabrinahalley.be shannahnatala.be shaylynndanyette.be sheenadorisa.be simonaglad.be sofiasharl.be suellenstevana.eu sulacynthy.be tabbielinzyaime.be tallouraine.be tamarraarlana.eu tomasinemufi.be traceyrebekkah.be vernicejania.be vivienewileen.be zonnyasofie.be R01-RU agathehelen.ru amburcatharine.ru arletashandee.ru augustinesophey.ru bestpharmtrade.ru brandaisabbye.ru briannaursa.ru canadianmedswebmart.ru charleanmelania.ru charmianvaleria.ru claudinedora.ru consuelobobbie.ru curingtabletreward.ru darsiemilly.ru denilyndell.ru doeannabella.ru drucilljazmin.ru faydraleola.ru firstbiologicalmall.ru florinakarine.ru georgiamona.ru georgianaillahally.ru goodorganicpurchase.ru goodwelnessassist.ru herbaldrugvalue.ru hortensianana.ru isismargie.ru leadingcanadian.ru magicherbalpurchase.ru margaretteemmaline.ru mariskacarine.ru marnireina.ru medicalhotmart.ru medicatinghotdeal.ru medicinalbestassist.ru mishachere.ru mygenericcompany.ru myherbalmarket.ru myrxmart.ru newmedicationmarket.ru newtreatmentsupply.ru norachryste.ru organicremedyoutlet.ru purecuringcompany.ru puresupplementvalue.ru robiniarani.ru sabrarosalind.ru safepharmquality.ru saferxeshop.ru securehealthmall.ru securehotshop.ru securewelnessoutlet.ru sharaihortense.ru sharonapatty.ru smartgenericmart.ru tamaraaurilia.ru theremedialassist.ru theremedymarket.ru yourdrugsquality.ru TUCOWS DOMAINS INC. charmanetherine.com suspended heddijacintha.com suspended jewelleranee.com suspended kelilagrazia.com suspended mellydodi.com suspended myaidgroup.com suspended Related spam operations See: Bulker.biz Category:Well-known Spam Category:Bulkerbiz Spam Category:Yambo family Category:Pharma spam